Data Breaches at State, Local Agencies Expose Data about Millions

Data breaches at state and local government agencies exposed the personal information
of nearly 3.8 million Americans in the first three quarters of this year, according
to the Privacy Rights Clearinghouse.

Most of the exposures came from a single incident in July at the Colorado Division
of Motor Vehicles that compromised information on 3.4 million people. But even
discounting that incident, the number of records exposed in breaches at state
and local agencies outstripped those reported at federal agencies in the same
period.

The figures underscore the need for standardized and improved data security
at state and local government agencies, said Abe Kleinfeld, president and chief
executive officer of nCircle Network Security Inc., of San Francisco.

"I don't think we are seeing an unusual amount of data breaches"
at the state and local levels, Kleinfeld said. "The danger is the kind
of data they have. It is becoming increasingly important that states begin developing
some kind of program."

The company compiled the data on state and local breaches from the Privacy
Rights Clearinghouse, which documented 20 breaches through September.

In the same period, the clearinghouse reported five incidents of breaches at
federal agencies that exposed the records of 23,024 people. The largest was
in May at the Marine Corps Reserve Center in San Antonio, where a contractor
improperly accessed and stole 17,000 records. Another incident at the International
Visa Service in Atlanta involved an employee's theft of data on 1,000
people.

The lower federal numbers illustrate improvements in the government's
data security, which Kleinfeld said can be attributed largely to the standardized
processes and controls required under the Federal Information Security Management
Act.

"There are a lot of complaints about FISMA, but I think it is hard to
argue that security has not improved in the federal government," he said.
"It has improved."

States remain vulnerable because there is no similar overarching standard for
data or information system security, he said. "We need some kind of program
like FISMA that extends across state and local governments," he added.

Imposing a nationwide standard for government data security would be difficult,
and it is unlikely to happen in the short run, Kleinfeld said. But FISMA-like
requirements could eventually be extended to state and local agencies that administer
federal programs or share data with federal agencies.

In the meantime, Sen. Norm Coleman (R-Minn.) introduced a bill last month that
could help. S. 3460, the State Cyber Security Protection Act of 2008, would
give the Homeland Security Department $25 million to fund a pilot program to
support cybersecurity efforts at the state level. The bill has been referred
to the Homeland Security and Governmental Affairs Committee.

A program to share best practices among agencies at all levels of government
and create cybersecurity templates, even if they are not mandated, would be
a big step forward in data security, Kleinfeld said.

Security breaches with exposure of personal data at the state level, as reported
by the Privacy Rights Clearinghouse through September, include: